Does the FTC Safeguards Rule apply to our dealership?
Short answer
If your dealership arranges financing or leasing, almost certainly. The FTC treats those dealers as financial institutions under the Gramm-Leach-Bliley Act. The updated Safeguards Rule requires a written information security program, a qualified person in charge of it, risk assessments, multi-factor authentication, encryption, and notifying the FTC of certain breaches.
Draft · pending expert review
The FTC updated the Safeguards Rule with specific technical requirements that took effect in 2023, and added a breach-notification requirement in 2024.
What the rule requires
- A qualified individual responsible for your security program
- A written risk assessment
- Safeguards, including access controls, encryption of customer information, and multi-factor authentication
- Monitoring and testing of those safeguards
- Staff training and service-provider oversight
- A written incident response plan
- A regular report to your board or owner
- Notifying the FTC of a breach involving the information of 500 or more consumers
Related: the Red Flags Rule
Dealers that extend credit may also need an identity-theft prevention program under the FTC's Red Flags Rule.